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In this paper we propose an extended version of the ping-pong protocol and study its security. 
The proposed protocol incorporates the usage of mutually unbiased bases in the control mode. We 
show that, by increasing the number of bases, it is possible to improve the security of this protocol. 
We also provide the upper bounds on eavesdropping average non-detection probability and propose 
a control mode modification that increases the attack detection probability. 
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I. INTRODUCTION 

A method of quantum secure direct communication 
(QSDC), contrary to quantum key distribution (QKD) 
schemes, offers the confidential exchange of determinis- 
tic messages without key agreement [12] . The interest in 
this fascinating idea started a decade ago in seminal pa- 
pers of Beige et.al. [T] and Bostrom et.al. [2J. Since then 
QSDC techniques have been developed following two dif- 
ferent paradigms: exploiting indistinguishability of non- 
orthogonal quantum states [TJ |U [21 H7J [22] and based on 
entanglement of signal particles with a system inaccessi- 
ble to the eavesdropper [2j [HJ [TBI [25] . The protocols from 
the former family are usually simpler to implement at 
the price of classic channel utilization in message mode, 
although exceptions of this rule exist [14 . On the other 
hand, the entanglement based ping-pong protocol uses 
classic channel only in control mode [2] . This feature can 
be exploited to build and additional cryptographic secu- 
rity layer which improves security of the protocol [2111124] . 
The ping-pong protocol has been also improved and ex- 
tended in other directions including super-dense infor- 
mation coding I21j and its variants based on higher 
dimensional signal particles [HI [23]. However, in the 
analyses of higher dimensional variants it was assumed 
that control mode is executed in at most two dual bases. 
This possibly understates an eavesdropping detectability. 

The main aim of this paper is to show that, by increas- 
ing the number of bases used in the control mode, it is 
possible to decrease an upper bound of the attack non- 
detection probability. Eavesdropping is most effectively 
detected if subsequent tests are executed in randomly 
selected mutually unbiased bases (MUB) [8!. Unfortu- 
nately, the problem of finding MUB for the arbitrary 
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Hilbert space remains unsolved and constructive solu- 
tions exist only for spaces of dimension N — p m where 
p is prime [TJ ^] and/or spaces with dimension not ex- 
ceeding six [3l [15] . 



II. PRELIMINARIES 



A. Mutually Unbiased Bases 
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A sequence of orthonormal bases {S<W , B W , . . . , B W } 
is called MUB if, for any two elements ) € 
b\ | ) G B^ n \ the following condition holds 
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where N denotes the dimension of underlying Hilbert 
space. The explicit construction of MUB is only known 
in the case of dimension N = p m , where p is a prime and 
m is a positive integer [7J . For an odd prime p we have [7J 
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where uj = e 27Tl ^ N , circled operations 0, 0, denote 
multiplication, division and subtraction in the finite field 
GF(p m ) respectively and \b^) are vectors of computa- 
tional basis. In the case of p — 2 the explicit formulas 
for the MUB elements are more involved |10) . 
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B. Ping-pong protocol operation 

Bob, the recipient of information, prepares an EPR 
pair composed of qudits [9] 
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One of the qudits, referred to as 'home', is kept confiden- 
tial, while the second one, called 'travel', is sent to Alice. 
Because of an entanglement, Alice's manipulations on the 
travel qudit induce non-local effects. Alice is able to en- 
code 2 log 2 N bits of information per one protocol cycle 
applying one of the unitary transformations 
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where v = 0, . . . , N — 1. Operator Q transforms the 
initial state into another EPR pair |Vv,i') |1 3 j which can 
be unambiguously discriminated by Bob when the 'travel' 
qudit is returned by Alice. Eavesdropping Eve cannot 
distinguish the travel qudit on its way forth and back 
from a maximally mixed state 
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so this way she cannot infer any information about the 
encoding operation used by Alice. Because of that indis- 
tinguishability, further analysis can be carried out as if 

Bob sent one of the randomly selected states \ba^) 0- 
However, Eve can entangle the 'travel' qudit with some 
ancilla system before it reaches Alice 
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where a — 0, . . . , N — 1 and \(j> a ,i) denotes Eve's probe 
states. That way, because of the introduced entangle- 
ment, Alice's encoding operation also modifies the state 
of the ancilla. By inspection of the ancilla's state Eve can 
gain some information about the encoded message. On 
the other hand, Eve's attack operation inevitably breaks 
the perfect correlation of the 'travel' and 'home' qudits, 
and that violation can be detected when Alice and Bob 
switch to control mode in which they perform local mea- 
surements on the possessed qudits and classically com- 
municate their results. Unfortunately, the control mode 
executed only in computational basis is insufficient, as 
Eve can mount an undetectable attack in which she can 
infer half the information posted by Alice []j|J H3J . It has 
been also shown in 23J that the incorporation of dual ba- 
sis removes such possibility. The question how protocol 
detectability can be improved by taking into account all 
possible mutually unbiased bases remains open. 



Without loss of generality it may be assumed that 
Bob sends a state \a) [21 [19]. It follows from ([6| that 
Pa^ — |a Q ,a| 2 describes the non-detection probability 
when computational basis B^ is used in control mode. 
If Alice selects another basis 2?( m ) then the 'travel' qudit 
after attack is seen as 
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where \a a , : ) = a a.i\ h i 
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The non-detection proba- 
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bility averaged over multiple control mode cycles is given 
by " 
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where M is the number of bases and q m describes relative 
frequency of their selection. 

It should be shown for completeness that in the control 
mode Bob can unambiguously infer Alice's local measure- 
ment result as long as he is informed about the used ba- 
sis. This follows from the fact that, as the local change of 
basis does not influence the entanglement, the measure- 
ment performed by Alice fully determines the outcome of 
Bob's measurement. Let us suppose that Alice performed 
a measurement in the basis B and obtained symbol i. In 
this case, the state of the system, after the projective 
measurement, reads 

QUi){Ui\®l) (X>>®l fc >) = |0i>® (EWM fc > J 
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where Ui is i vector of the basis B. From the above one 
can notice that, if Bob performs a measurement in the 
basis B, he will obtain the symbol i with probability 1. 



III. BOUNDS ON THE NON-DETECTION 
PROBABILITY 

Let us begin with general theorem concerning non- 
detection probability. 

Theorem 1. Let {£ (0) , B {1 \ . . . , B {M) } beasetofM+1 
orthonormal bases, used in the control mode of the proto- 
col and selected equally frequently. Then, the upper bound 
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for the average non-detection probability ^ is given by 

d a < ^l(v {a) l (ID 

where <7i(V^ a )) denotes the greatest singular value of 

Proof. Let us denote by v m the a th element of B^ m \ By 
we denote a matrix with rows given by bra vectors 

(v m \, i.e. vj^j = B™j (overline denotes complex conju- 
gate). If control bases are selected equally frequently the 
average non-detection probability ^ can be written as 
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and since maxi T \ we obtain the 

result. □ 

Let us now assume that the control mode is executed 
in M + l mutually unbiased bases. In this case the upper 
bound on the non-detection probability is stated in the 
following theorem. 

Theorem 2. If the control mode is executed in M + 1 
mutually unbiased bases, then the average non-detection 
probability is bounded by 
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1 + M 



(13) 



Proof. Let us introduce a matrix W = y( Q )\/( a )t where 
is defined as in the proof of Theorem [I] Directly 
from the definition of matrix and MUB condition ([I]) 
we get 



W id = (vilvj) = {6 itj + (1 - 6^)e^ /VN}^ =Q . (14) 

Note that matrix W does not depend on the particular 
a. The maximal singular value of the matrix W can be 
bounded as [16] (see also inequality [11, Eq. (3.7.2)]) 

a x {W)< ((ma^J2\ W iM^^\Wij\)\ • (15) 

Taking into account ( [14] ) we get 

max^ \W itj \ = max^ \W itj \ = 1 + M/y/N, (16) 

3 « 

and the result follows from Theorem [T] and the fact that 
af(V^) = a 1 (W). □ 

In the case of dimension N — p m for prime p and 
m being a positive integer, there exists a set of N + 1 
mutually unbiased bases [7], and the bound (13) reads 
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It is possible to improve this bound using explicit expres- 
sion |2]). 



Theorem 3. Let N = p m where p is an odd prime and 
m is a positive integer. Then the maximal non-detection 
probability is bounded by 
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Proof. Let us introduce matrix W — ywtyw f or some 
fixed a 

N N 

w„ v = Eo^w^ = E B S^i- (1 9 ) 
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Matrix W may be decomposed as W = P + Q: 
p — r(°) — a a 
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8(ne»)e{fi®v),a and usin S bound ([15]) we get 0-1 (Q) < 2. 
Obviously cri(P) = 1. Thesis follows from ( fll] ) combined 
with af(V) = <Ji{W) and inequality [TO Eq. (3.3.17)] 
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It has been shown that usage of at least two dual 
bases is sufficient to ensure asymptotic protocol secu- 
rity [23]. However, the detection capabilities of the con- 
trol mode are significantly improved when more mutually 
unbiased bases are used. This follows from the compar- 
ison of the bound on average non-detection probability 
obtained in [23] (curve (d) on Fig. [I]) with the bounds 
obtained herein (curves (b) to (d)). The improvement of 
the protocol's detectability becomes more apparent with 
the increase of the dimension of the underlying Hilbert 



space - for bound from [23 we have linijv- 
while for (17) and (18) limyv^oo ^max = 



the asymptotic behavior of the bounds (17) and (18) is 
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0. Although 



similar, they differ in the provided optimality. 

The comparison of the considered bounds with nu- 
merical results is presented in Fig. [T] It follows that 
bound ( 18 ) is close to optimal. It was also verified that 



the best fitting to numerical estimates is achieved for 
°i(Y) = !( 3 + V5) ~ 2.618. 

Further improvement can be proposed based on the 
analysis of the proof of Theorem [3] The matrix P is 
related to the control mode tests executed in the compu- 
tational basis. If that basis is excluded from the control 
mode, one obtains a better protocol behaviour. We can 
state the following. 
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FIG. 1: Comparison of upper bounds on average proba- 
bility of non-detection calculated: a) via numerical simula- 



tions, b) with expression (181, c) with expression 1 171, d) 
when only two bases are used in control mode [23] (d max = 
(1 + 1A/A0/2). 



Corollary 1. Let us assume, that N = p m , where p is 
an odd prime and m is a positive integer, and the compu- 
tational basis is excluded from the control mode. In this 
case an average non-detection probability is bounded by 



d a < 2/N. 



(23) 



It should be noted that, as the information is encoded 
and decoded in the computational basis, Eve still has to 
use this basis for an attack preparation. Comparing the 
above bound with the numerical estimate for the semi- 
nal protocol, we observe about 30% improvement in an 
attack detection capabilities. 



IV. CONCLUSIONS 



In this paper we have proposed an extended version 
of the ping-pong protocol, which incorporates the usage 
of mutually unbiased bases in the control mode. We 
provided upper bounds on eavesdropping average non- 
detection probability in the proposed protocol. 

If the communicating parties use M + 1 mutually un- 
biased bases in the control mode, the bound is given by 
the leading singular value of the matrix with rows given 
by the appropriate bra vectors. One should note that 
the number M of bases used in the control mode should 
depend on the dimension. 

If the communicating parties use particles of dimension 
N = p m , where p is an odd prime and m is a positive inte- 
ger, it is possible to provide a better estimate. Assuming 
that Alice and Bob use N + 1 bases and construct them 
according to [7], the non-detection probability averaged 
over sufficiently many cycles never exceeds 3/(N + 1). 
Eavesdropping detection capabilities can be improved by 
the exclusion of the computational basis from the control 
mode. 
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